Decentralized trust assessment

ABSTRACT

A decentralized trust assessment system, comprising a neural network, a trust module, and a local subsystem, wherein the trust module controls whether a plurality of inputs to the local subsystem are trustworthy. The decentralized trust assessment system provides rotorcraft and tiltrotor aircraft with airborne systems able to detect bad and spoofed data from a wide variety of data streams.

CROSS-REFERENCE TO RELATED APPLICATIONS

Not applicable.

STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT

Not applicable.

BACKGROUND

Modern day aircraft require their avionics systems to be reliablebecause so much of the actual control of the aircraft is done by partsof the avionics system. Some conventional avionics systems utilize onlya trust assessment module. The trust assessment module is configured foraccepting various input data streams and making quality determinationson those input data streams. Having only a trust assessment modulelimits the robustness of the system. For example, trust assessmentmodules look for data streams that have failed, are stuck at a value, orhave reached a maximum or minimum. When the trust module has not beenprogrammed to look for a specific condition, the trust module cannotdetect it. Therefore, limitations exist in conventional trust assessmentmodules.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is an oblique view of a tiltrotor aircraft according to thisdisclosure.

FIG. 2 is a side view of a rotorcraft according to this disclosure.

FIGS. 3A and 3B are schematic views of a decentralized trust assessmentsystem according to this disclosure.

FIG. 4 is a schematic view of a decentralized trust assessment systemaccording to this disclosure.

FIG. 5 is a schematic view of a decentralized trust assessment systemaccording to this disclosure.

FIG. 6 is a schematic view of a decentralized trust assessment systemaccording to this disclosure.

FIG. 7 is a schematic view of a decentralized trust assessment systemaccording to this disclosure.

DETAILED DESCRIPTION

In this disclosure, reference may be made to the spatial relationshipsbetween various components and to the spatial orientation of variousaspects of components as the devices are depicted in the attacheddrawings. However, as will be recognized by those skilled in the artafter a complete reading of this disclosure, the devices, members,apparatuses, etc. described herein may be positioned in any desiredorientation. Thus, the use of terms such as “above,” “below,” “upper,”“lower,” or other like terms to describe a spatial relationship betweenvarious components or to describe the spatial orientation of aspects ofsuch components should be understood to describe a relative relationshipbetween the components or a spatial orientation of aspects of suchcomponents, respectively, as the device described herein may be orientedin any desired direction.

This disclosure teaches a system comprised of trust assessment modulesin conjunction with neural networks. The improved system can identifywhen data streams meet a predetermined condition and when the datastreams have formed a pattern worth being concerned over. Those datastreams include inputs to the aircraft subsystem, outputs of theaircraft subsystem, and the state of the aircraft subsystem itself. Thedecentralized trust assessment system (DTAS) verifies that the aircraftsubsystem is receiving good data and is not being spoofed by combining atrust module with a neural network. The system further verifies that theaircraft subsystem is generating good data. The system can override thefaulty subsystem and provide a better quality output data stream. Thetrust module in combination with the neural network verifies the format,the authenticity, and the content of the inputs to the subsystem. Thetrust module in combination with the neural network verifies thesubsystem behavior is appropriate. Neural networks do not requirespecific preprogramming to detect bad streams of data, however, theirdetection of bad streams of data is not absolute. Trust modules dorequire specific programming to detect bad streams of data, however,they cannot detect what they are not programmed for. Trust modules alsocan be a software component that is executed either within a processorof the subsystem or physically separate from it. Combining the twoelements results in a superior airborne DTAS.

FIG. 1 illustrates a tiltrotor aircraft 101 equipped with adecentralized trust assessment system (DTAS) 401 according to thisdisclosure. Aircraft 101 has a fuselage 103 with a cockpit 105 locatedin a forward portion of fuselage 103. Wings 107, 109 are attached tofuselage 103, and an engine nacelle 111, 113 is rotatably attached tothe outer end of each wing 107, 109, respectively. Each nacelle 111, 113houses an engine (not shown), which is operably connected to a rotatableproprotor 115, 117. Each proprotor 115, 117 comprises three blades 119.Proprotors 115, 117 rotate in opposite directions and comprise similarcomponents, though components in proprotors 115, 117 may be constructedand/or installed in a mirror, or reverse, manner from the oppositeproprotor 115, 117. Aircraft 101 requires a plurality of flight controlcomputers in conjunction with pilot inputs to fly the aircraft. Flightcontrol computers rely on various sensors, such as pitot staticairspeed, gyroscopes, global positioning sensors, accelerometers,thermocouples, etc. for providing conditional information to the flightcontrol computers. An example is the flight control computer's use ofairspeed to vary the speed of proprotors 115,117. The airspeed system isverified by the DTAS 401 before the airspeed data is passed to theflight control computers. Therefore, the flight control computer canoperate with a higher level of data confidence.

FIG. 2 illustrates a rotorcraft 201 equipped with a decentralized trustassessment system (DTAS) 401 according to this disclosure. Rotorcraft201 comprises a rotary system 203 carried by a fuselage 205. One or morerotor blades 207 operably associated with rotor system 203 provideflight for rotorcraft 201 and are controlled with a plurality of controlsticks within fuselage 205 feeding inputs into a flight controlcomputer. For example, during flight a pilot can manipulate the cyclicstick 209 to change the pitch angle of rotor blades 207, thus providinglateral and longitudinal flight direction, and/or manipulate pedals 211for controlling yaw direction, furthermore the pilot can adjust thecollective stick 213 to change the pitch angles of all of the rotorblades concurrently. The sticks and pedal movements are measured bypotentiometer systems. The potentiometer systems feature a portion ofthe DTAS 401 and determine whether the data from the potentiometers istrusted. That trusted data is then provided to a flight control systemhaving a portion of the DTAS 401.

FIG. 3A illustrates an untrusted training system 301 for a neuralnetwork of a decentralized trust assessment system (DTAS). Untrustedtraining system 301 is comprised of a subsystem 303, a plurality ofuntrusted training sets 305, and a trained neural network 307.

The plurality of untrusted training sets 305 is comprised of a summationof inputs to the subsystem 313 and outputs of the subsystem 315. Theplurality of untrusted training sets 305 are provided repetitively tothe trained neural network 307. The neural network reviews the pluralityof untrusted training sets 305 learning to detect patterns in theplurality of untrusted training sets. For example, a swashplateactuator's control signal and a collective position signal can be inputsto the untrusted training system 301. Conventionally the subsystem mightanalyze the swashplate actuator's control signal and the collectiveposition signal to check if the signals are hitting any maximums orminimums. The trained neural network 307 can analyze the signals to finda pattern where an amplitude of the collective position signal isdecreasing while the swashplate actuator's control signal is increasing,thereby indicating an issue.

FIG. 3B illustrates a trusted training system 331 for a neural networkof a DTAS. Untrusted training system 331 is comprised of a subsystem333, a trust module 335, a plurality of trusted training sets 337, and atrusted trained neural network 339.

The plurality of untrusted training sets 337 is comprised of a summationof inputs to the subsystem 341 and outputs of the subsystem 343. Theplurality of trusted training sets 337 are provided repetitively to thetrusted trained neural network 339. The neural network reviews theplurality of trusted training sets 337 learning to detect patterns inthe plurality of trusted training sets. For example, a trusted neuralnetwork can be developed for icing systems while the aircraft iscompleting icing testing.

The trust module 335 adds additional confidence in the trusted trainedneural network 339 because the trust module reviews incoming datastreams into the local subsystem to validate the quality of the incomingdata streams. For example, local subsystem 333 is responsible foractivation of an icing system to heat the wing upon accumulation of iceon the leading edges of the wings and the rotors. The trust module 335is typically a preprocessor that ensures data and control signals arebeing processed within a set of bounds and within a set of expectations.Trust module 335 can be programmed to look at various thermocoupleslocated across the wing. The trust module 335 utilizes elements such asneural network 339, decision trees, artificial and machine intelligencemethods, bounds checking, and other techniques rooted in software,firmware, and/or hardware to verify the incoming inputs and the providedinputs. Trust module 335 detects when any of those thermocouples arereporting an impossible or unlikely temperature, such as absolute zero,and in response the trust module can flag the thermocouple data as bador questionable. Therefore, the local subsystem 333 will not use thefailed thermocouple data. Trusted trained neural network 339 mightdetect that as thermocouples are failing, their outputs ramp down toabsolute zero over a period of time. Together the trust module 335 andthe trusted trained neural network 339 collectively work to detectfailing sensors and failed sensors by the data they generate.

FIG. 4 illustrates a decentralized trust assessment system (DTAS) 401.DTAS 401 is comprised of a subsystem 403, a trust module 405, a trainedneural network 407, a set of inputs 409, and a set of outputs 411. Oncea trusted neural network is trained as described above, it can beutilized in conjunction with a trust module to increase the reliabilityof various airborne systems on a rotorcraft or tiltrotor aircraft.

The set of input data 409 is provided to both the trained neural network407 and the trust module 405 for data quality reviews. The trust module405 reviews the set of input data 409 for specific programmed elementssuch as data streams indicating maximums or minimums. The trained neuralnetwork 407 also reviews the set of input data 409 for pattern detectionbased upon the training of the trained neural network 407. An output ofthe trained neural network 407 is provided to the trust module 405 toprovide increased confidence in the trust module's assessment of aquality of the set of input data 409. Local subsystem 403 operates basedupon the trust module's 405 output and also provides data to the trustmodule 405 for consistency. Outputs of the trained neural network 407,the trust module 405, and the local subsystem 403 form the set of outputdata 411.

An example of the DTAS 401 uses accelerometers from a tilt-axis gearboxof a tiltrotor. Data streams from a plurality of accelerometers are fedto both the trained neural network 407 and the trust module 405. Thetrust module 405 detects accelerometers that have failed or areproviding data outside a predetermined max window. The trained neuralnetwork 407 spots when spectral patterns of the plurality ofaccelerometers are diverging away from each other, thereby indicating afailing gearbox. The outputs from the trust module 405 and the trainedneural network 407 are provided to local subsystem 403, for example, agearbox monitoring system, to indicate a worn tilt-axis gearbox.

FIG. 5 illustrates a decentralized trust assessment system (DTAS) 501.DTAS 501 is comprised of a subsystem 503, a trust module 505, a trainedneural network 507 located in the trust module 505, a set of inputs 509,and a set of outputs 511. Once a trusted neural network is trained asdescribed above, it can be utilized inside trust module 505 to increasethe reliability of various airborne systems on a rotorcraft or tiltrotoraircraft.

The set of input data 509 is provided to the trust module 505 with thetrained neural network 507 located inside the trust module 505 for dataquality reviews. The trust module 505 reviews the set of input data 509for specific programmed elements such as data streams indicatingmaximums or minimums. The trained neural network 507 also reviews theset of input data 509 for pattern detection based upon the training ofthe neural network. Local subsystem 503 operates based upon the trustmodule's 505 output and also provides data to the trust module 505 forconsistency. All outputs of the trust module 505 and the local subsystem503 form the set of outputs 511.

An example of the DTAS 501 uses for example, Aeronautical Radio,Incorporated (ARNIC) data from a flight control computer. Data streamsfrom the flight control computer are fed to the trust module 505. Thetrust module 505 detects bus channels that have failed or are providingdata outside a predetermined max window. The trained neural network 507located in the trust module 505 can spot when odd-numbered bus channelsare cycling from min to max indicating a databus issue. The outputs fromthe trust module 505 are provided to local subsystem 403, and indicate abad or faulty ARNIC standard 429 data bus.

FIG. 6 illustrates an alternative decentralized trust assessment system(DTAS) 601. DTAS 601 is comprised of a subsystem 603, a trust module605, a trusted trained neural network 607 located outside both thesubsystem 603 and the trust module 605, a set of inputs 609, and a setof outputs 611. Once a trusted neural network is trained as describedabove it can be utilized to increase the reliability of various airbornesystems on a rotorcraft or tiltrotor aircraft.

The set of input data 609 is provided to the trust module 605 for dataquality reviews. The trust module 605 reviews the set of input data 609for specific programmed elements such as data streams indicatingmaximums or minimums. Local subsystem 603 operates based upon the trustmodule's 605 output and also provides data to the trust module 605 forconsistency. All outputs of the trust module 605 and the local subsystem603 form the set of outputs 611. The set of outputs 611 are fed into thetrained neural network 607 for pattern detection based upon the trainingof the neural network.

FIG. 7 illustrates another alternative decentralized trust assessmentsystem (DTAS) 701. DTAS 701 is comprised of a subsystem 703, a trustmodule 705, a trusted trained neural network 707 located outside thesubsystem 703 and the trust module 705, a set of inputs 709, and a setof outputs 711. Once a trusted neural network 707 is trained asdescribed above it can be utilized to increase the reliability ofvarious airborne systems on a rotorcraft or tiltrotor aircraft.

The set of input data 709 are provided to the trust module 705 for dataquality reviews. The trust module 705 reviews the set of input data 709for specific programmed elements such as data streams indicatingmaximums or minimums. Local subsystem 703 operates based upon the trustmodule's 705 output and also provides data to the trust module 705 forconsistency. All outputs of the trust module 705 and the local subsystem703 form the set of outputs 711. The set of outputs 711 are fed into thetrained neural network 707 for pattern detection based upon the trainingof the neural network. An output of the neural network is fed back intothe set of inputs 709 and provides feedback to the local subsystem 703.

It should be noted that the decentralized trust assessment systemdescribed above increases the reliability of airborne systems located onaircraft and rotorcrafts. Neural networks alone increase the robustnessof the aircraft by allowing pattern recognition to occur withoutspecific programming to identify the pattern. Neural networks inconjunction with trust modules are combined to increase the robustnessof the aircraft by allowing pattern recognition without specificprogramming and allowing the aircraft to detect bad data streams fromfailed systems and spoofing and allow the aircraft to deem sourcestrustworthy.

At least one embodiment is disclosed, and variations, combinations,and/or modifications of the embodiment(s) and/or features of theembodiment(s) made by a person having ordinary skill in the art arewithin the scope of this disclosure. Alternative embodiments that resultfrom combining, integrating, and/or omitting features of theembodiment(s) are also within the scope of this disclosure. Wherenumerical ranges or limitations are expressly stated, such expressranges or limitations should be understood to include iterative rangesor limitations of like magnitude falling within the expressly statedranges or limitations (e.g., from about 1 to about 10 includes, 2, 3, 4,etc.; greater than 0.10 includes 0.11, 0.12, 0.13, etc.). For example,whenever a numerical range with a lower limit, R_(I), and an upperlimit, R_(u), is disclosed, any number falling within the range isspecifically disclosed. In particular, the following numbers within therange are specifically disclosed: R=R_(I)+k *(R_(u)-R^(I)), wherein k isa variable ranging from 1 percent to 100 percent with a 1 percentincrement, i.e., k is 1 percent, 2 percent, 3 percent, 4 percent, 5percent, . . . 50 percent, 51 percent, 52 percent, . . . , 95 percent,96 percent, 95 percent, 98 percent, 99 percent, or 100 percent.Moreover, any numerical range defined by two R numbers as defined in theabove is also specifically disclosed. Use of the term “optionally” withrespect to any element of a claim means that the element is required, oralternatively, the element is not required, both alternatives beingwithin the scope of the claim. Use of broader terms such as comprises,includes, and having should be understood to provide support fornarrower terms such as consisting of, consisting essentially of, andcomprised substantially of. Accordingly, the scope of protection is notlimited by the description set out above but is defined by the claimsthat follow, that scope including all equivalents of the subject matterof the claims. Each and every claim is incorporated as furtherdisclosure into the specification and the claims are embodiment(s) ofthe present invention. Also, the phrases “at least one of A, B, and C”and “A and/or B and/or C” should each be interpreted to include only A,only B, only C, or any combination of A, B, and C.

What is claimed is:
 1. A decentralized trust assessment system,comprising: a neural network; a trust module; and a local subsystem;wherein the trust module controls whether a plurality of inputs to thelocal subsystem are trustworthy.
 2. The decentralized trust assessmentsystem of claim 1, wherein the neural network is located between theplurality of inputs and the trust module.
 3. The decentralized trustassessment system of claim 1, wherein the neural network is locatedinside the trust module.
 4. The decentralized trust assessment system ofclaim 1, further comprising: a plurality of outputs from the localsubsystem and the trust module; wherein the neural network is providedthe plurality of outputs.
 5. The decentralized trust assessment systemof claim 4, wherein the neural network provides feedback to the trustmodule through the plurality of inputs.
 6. The decentralized trustassessment system of claim 1, wherein the neural network is based upon atraining set.
 7. The decentralized trust assessment system of claim 1,wherein the neural network is based upon a trusted training set.
 8. Amethod of decentralizing trust assessments, comprising: training aneural network to create a trained neural network; programming a trustmodule to review a data stream for a condition; reviewing the datastream with the trust module for the condition; and analyzing the datastream for a pattern with the trained neural network.
 9. The method ofclaim 8, further comprising: flagging the data stream if the conditionis met.
 10. The method of claim 8, further comprising: flagging the datastream if the pattern is detected by the trained neural network.
 11. Themethod of claim 8, the step of training comprising: summing the datastream before and after a local subsystem.
 12. The method of claim 8,the step of training comprising: summing the data stream before andafter a local subsystem in combination with the trust module.
 13. Themethod of claim 8, wherein the step of analyzing the data stream for apattern with the trained neural network occurs before the step ofreviewing the data stream with the trust module for the condition. 14.The method of claim 8, wherein the step of analyzing the data stream fora pattern with the trained neural network occurs after the step ofreviewing the data stream with the trust module for the condition.
 15. Adecentralized trust assessment system of an aircraft, comprising: atleast one input data stream from the aircraft; a local subsystem in theaircraft, the local subsystem configured to act upon the at least oneinput data stream; a trained neural network; and a trust moduleconfigured to analyze the at least one input data stream; wherein thetrust module controls whether the at least one input data stream to thelocal subsystem is acted upon by the local subsystem.
 16. Thedecentralized trust assessment system of claim 15, wherein the trainedneural network is located between the at least one input data stream andthe trust module.
 17. The decentralized trust assessment system of claim15, wherein the trained neural network is located inside the trustmodule.
 18. The decentralized trust assessment system of claim 15,further comprising: at least a first output of the local subsystem andof the trust module; wherein the trained neural network reviews the atleast a first output.
 19. The decentralized trust assessment system ofclaim 18, wherein the trained neural network provides feedback to thetrust module.
 20. The decentralized trust assessment system of claim 19,wherein the trust module replaces the first output based on the trainedneural network.